Let's suppose that someone was to say to me either:
(a) "Obama appears to be the greatest and most ethical President of our times", or
(b) "Obama appears to be the greatest liar and most deceiving President of our times".

"A" totally needs to be in the Silly Humor thread.

But just about any president's name would suffice...

I put this in this thread as it seemed relevant to the SnowdenGate revelations re snooping/surveillance of traffic flowing variously through ISPs, Google, Microsoft, etc. - that is, SCS (State & Corporate Surveillance).

If the proposals of the IETF (Internet Engineering Task Force) Internet-Draft "Explicit Trusted Proxy in HTTP/2.0" (14 Feb 2014) are agreed, then this snooping/surveillance looks like it could be formalised as "standard practice" in the Internet architecture, and authorised and enabled regardless of Internet users' wishes.

Currently I am aware of only one publicly available and apparently feasible defeat for "man-in-the-middle" attacks by ISPs, governments or other criminals - that would seem to be OpenDNSCrypt.
One wonders how long that is going to be tolerated by the SCS fraternity or indeed whether OpenDNS might not already have been obliged to compromise OpenDNSCrypt without publishing that fact. One would have no way of knowing for sure. It's all about Trust.

(Copied below sans embedded hyperlinks/images.)

No, I Don't Trust You! -- One of the Most Alarming Internet Proposals I've Ever Seen
February 22, 2014

If you care about Internet security, especially what we call "end-to-end" security free from easy snooping by ISPs, carriers, or other intermediaries, heads up! You'll want to pay attention to this.

You'd think that with so many concerns these days about whether the likes of AT&T, Verizon, and other telecom companies can be trusted not to turn our data over to third parties whom we haven't authorized, that a plan to formalize a mechanism for ISP and other "man-in-the-middle" snooping would be laughed off the Net.

But apparently the authors of IETF (Internet Engineering Task Force) Internet-Draft "Explicit Trusted Proxy in HTTP/2.0" (14 Feb 2014) haven't gotten the message.

What they propose for the new HTTP/2.0 protocol is nothing short of officially sanctioned snooping.

Of course, they don't phrase it exactly that way.

You see, one of the "problems" with SSL/TLS connections (e.g. https:) -- from the standpoint of the dominant carriers anyway -- is that the connections are, well, fairly secure from snooping in transit (assuming your implementation is correct ... right?)

But some carriers would really like to be able to see that data in the clear -- unencrypted. This would allow them to do fancy caching (essentially, saving copies of data at intermediate points) and introduce other "efficiencies" that they can't do when your data is encrypted from your client to the desired servers (or from servers to client).

When data is unencrypted, "proxy servers" are a routine mechanism for caching and passing on such data. But conventional proxy servers won't work with data that has been encrypted end-to-end, say with SSL.

So this dandy proposal offers a dandy solution: "Trusted proxies" -- or, to be more straightforward in the terminology, "man-in-the-middle attack" proxies. Oh what fun.

The technical details get very complicated very quickly, but what it all amounts to is simple enough. The proposal expects Internet users to provide "informed consent" that they "trust" intermediate sites (e.g. Verizon, AT&T, etc.) to decode their encrypted data, process it in some manner for "presumably" innocent purposes, re-encrypt it, then pass the re-encrypted data along to its original destination.

Chomping at the bit to sign up for this baby? No? Good for you!

Ironically, in the early days of cell phone data, when full capability mobile browsers weren't yet available, it was common practice to "proxy" so-called "secure" connections in this manner. A great deal of effort went into closing this security hole by enabling true end-to-end mobile crypto.

Now it appears to be full steam ahead back to even worse bad old days!

Of course, the authors of this proposal are not oblivious to the fact that there might be a bit of resistance to this "Trust us" concept. So, for example, the proposal includes the assumption of mechanisms for users to opt-in or opt-out of these "trusted proxy" schemes.

But it's easy to be extremely dubious about what this would mean in the real world. Can we really be assured that a carrier going through all the trouble of setting up these proxies would always be willing to serve users who refuse to agree to the proxies being used, and allow those users to completely bypass the proxies? Count me as skeptical.

And the assumption that users can even be expected to make truly informed decisions about this seems highly problematic from the git-go. We might be forgiven for suspecting that the carriers are banking on the vast majority of users simply accepting the "Trust us -- we're your friendly man-in-the-middle" default, and not even thinking about the reality that their data is being decrypted in transit by third parties.

In fact, the fallacies deeply entrenched in this proposal are encapsulated within a paragraph tucked in near the draft's end:

"Users should be made aware that, different than end-to-end HTTPS, the achievable security level is now also dependent on the security features/capabilities of the proxy as to what cipher suites it supports, which root CA certificates it trusts, how it checks certificate revocation status, etc. Users should also be made aware that the proxy has visibility to the actual content they exchange with Web servers, including personal and sensitive information."

Who are they kidding? It's been a long enough slog just to get to the point where significant numbers of users check for basic SSL status before conducting sensitive transactions. Now they're supposed to become security/certificate experts as well?

Insanity.

I'm sorry gang, no matter how much lipstick you smear on this particular pig -- it's still a pig.

The concept of "trusted proxies" as proposed is inherently untrustworthy, especially in this post-Snowden era.

And that's a fact that you really can trust.

--Lauren--
I'm a consultant to Google. My postings are speaking only for myself, not for them.

- - -

Addendum (24 February 2014): Since the posting of the text above, I've seen some commentary (in at least one case seemingly "angry" commentary!) suggesting that I was claiming the ability of ISPs to "crack" the security of existing SSL connections for the "Trusted Proxies" under discussion. That was not my assertion.

I didn't try to get into technical details, but obviously we're assuming that your typical ISP doesn't have the will or ability to interfere in such a manner with properly implemented traditional SSL. That's still a significant task even for the powerful intelligence agencies around the world (we believe at the moment, anyway).

But what the proposal does push is the concept of a kind of half-baked "fake" security that would be to the benefit of dominant ISPs and carriers but not to most users -- and there's nothing more dangerous in this context than thinking you're end-to-end secure when you're really not.

In essence it's a kind of sucker bait. Average users could easily believe they were "kinda sorta" doing traditional SSL but they really wouldn't be, 'cause the ISP would have access to their unencrypted data in the clear. And as the proposal itself suggests, it would take significant knowledge for users to understand the ramifications of this -- and most users won't have that knowledge.

It's a confusing and confounding concept -- and an unwise proposal -- that would be nothing but trouble for the Internet community and should be rejected.

- - -

Posted by Lauren at February 22, 2014 08:24 PM | Permalink
Twitter: @laurenweinstein
Google+: Lauren Weinstein

^Really! Can you believe it?

Amazing how brave these people are to speak out - once everybody else has.

Sad truth is that virtually none of these industry leading lights much cared until it started becoming obvious that the current state of affairs was going to hurt their business in the long run.

If "voluntary cooperation" could have been made to pay off, they'd still be as silent as clams. Just like they pretty much were up until a month or two ago.

[attach]

Sadly if the US government wasn't wasting so much time peeking in our backyards and panty drawers, they'd of had time to grab a few shots of the rest of the planet and we'd know where that Malaysian plane went.

Yeah. It's much like the one thing about SETI that always made me laugh...

It gets no government funding because it's been called a waste of time and resources. But IF SETI ever did detect a signal that was clearly and provably from some extraterrestrial source, the feds and their military would be in there in a heartbeat, grabbing files, seizing facilities, shutting down networks, slapping DoD and NSA classification stickers on everything in sight, "debriefing" (i.e. threatening) every SETI researcher and employee they could put a finger on to keep their mouths shut...

The day SETI succeeds is the day SETI (as a public science project) will cease to exist.

But that's ok. Because it's for our "protection."

Quote from: Stoic Joker on March 14, 2014, 12:11 PM

Sadly if the US government wasn't wasting so much time peeking in our backyards and panty drawers, they'd of had time to grab a few shots of the rest of the planet and we'd know where that Malaysian plane went.

...

The day SETI succeeds is the day SETI (as a public science project) will cease to exist.

Yes, but at least we'll know that when SETI shuts down...The Invasion is only months away ... So we get a little something out of that deal.

P.S. ^That^ is why I suck at being an optimist.

^ So just think what it will be like if they ever find intelligent life on this planet.

Yeah, like that's ever going to happen.

Yes, but at least we'll know that when SETI shuts down...The Invasion is only months away ...

Really? I don't think we'll have the chops to take on or invade an extraterrestrial civilization ever. We're far too enthusiastic about shutting down scientific research and technical schools to ever develop such advanced capabilities. We're also more than content with patenting the obvious - and then fighting over it - to make any real advances.

Besides, the money is needed for far more important things, like giving every town in the USA with a population over 4000 their very own police tank, monitoring every scrap of digital communication - and storing it forever, and bailing out our corrupt financial institutions so they can still pay their criminal directors their annual bonuses...

I mean c'mon! As a people we need to set priorities.

[attachimg=#]

http://chason.smbc-comics.com/?id=3277#comic

Brilliant, Tomos 

Quote from: Vurbal on March 14, 2014, 03:36 PM

^ So just think what it will be like if they ever find intelligent life on this planet.
___________________

There is intelligent life on this planet, but I'm just passing through...

You might want to go around instead. It gets pretty hot toward the center.   

...You might want to go around instead. It gets pretty hot toward the center.  
______________________

Heh. Do you know this from first-hand experience?

Your amusing comment just reminded me of a story told me by a Welsh computer salesman some years ago:
__________________________

The English salesman in Cardiff.
An English computer salesman from London was attending a 4-day sales convention in Cardiff (Wales) towards the beginning of Winter.
He drove there by car, checked-in to his pre-booked hotel, and attended the conference each day, usually ending up each evening in a local pub, after dinner, where he would drink solidly at the bar until closing time, and then go to bed.

On the evening of the third day of the convention, he was in the pub, and was talking with the Welsh barman, complaining bitterly about the weather. It had rained incessantly for the 3 days whilst he had been there so far.

"I tell you," he said, "it had been fine when I left England, a crisp Winter's day, but it started to rain as soon as I got across the ruddy border into Wales, and it hasn't f###ing stopped. It rained all during the drive to Cardiff, and by the time I got to my hotel it was f###ing bucketing down. The first night the noise of the heavy rain f###ing drumming against the window of my hotel room ensured that I didn't get much bloody sleep. It was raining at breakfast time the next morning, it was bloody raining all during the convention that day, so we didn't get out to see some of the historical sights around Cardiff that had been planned. It was still pissing down whilst I was having dinner that evening, and when I came over to this pub after dinner it was f###ing bucketing down again.
Now I wouldn't mind, if it had been just the one day, but it's gone on for three f###ing days solid now without letup. Rain, f###ing rain, f###ing rain. Easing off to a fine drizzle for a few hours would have been nice - I could have enjoyed the brief respite - but no, it's just been f###ing bucketing down and bucketing down all the f###ing time and I tell you I'm f###ing fed up with it. I've had enough. I'd have f###ing gone home today if I could have, just to get out of this f###ing waterlogged hole, but I can't you see, because I've got to f###ing well stick around to the bitter end of this sales convention as I am the main sales rep for my company, and I have to make a speech tomorrow, so I can't f###ing leave until after that.
I'd never been to Cardiff before this week. If I'd known what a f###ing waterlogged s##thole it was I would never have f###ing come. This place has to be the f###ing arsehole - the bloody rectum - of the world, I f###ing kid you not."

At this point, he put his pint glass to his lips and took a long, slow drink of the amber liquid. The bar had gone silent, and the several local Welshmen drinking nearby who had been listening intently to his diatribe against the weather were looking curiously at him. One of them, who was sat just a couple of bar stools away from the salesman, turned towards him and enquired, "Oh yes, just passing through are you?"

^^ @40hz: Have you got the link for that movie/trailer? Sounds guuud! 

Re. MH370 - It amazes me that there isn't an EPIRB^w mounted on aircraft tail assemblies that:

a) like most boats/ships, start transmitting the moment they hit water.
b) activates on collision.
c) can't be switched off internally, it's autonomous.

You could even make it a bit smarter: it's fed the terminating coords by the originating tower according to flight plan and if the point at which velocity falls below sustained flight occurs doesn't happen within a specified radius of the termination, it goes off.

What use is the f'n flight recorder if you can't find the aircraft in the first place?